Remote Access Session Monitoring for Unfamiliar OT Activity Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing remote access session monitoring in OT networks is inefficient and prone to missed detection of malicious or unfamiliar activities, leading to potential cyber-attacks and operational disruptions, with high resource wastage and safety risks.
Innovation Solution
An automated system using machine learning models to detect unfamiliar and malicious user activities during remote access sessions by analyzing user activity data, initiating preventive actions such as session termination or alert notifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual monitoring of remote access sessions is implemented, then security oversight is provided, but resource wastage increases and detection accuracy decreases
Solution Approach 1:
The patent replaces manual mechanical monitoring with automated machine learning-based detection systems. The ML models analyze user activity data, screen recordings, and session metadata automatically, eliminating the need for human supervisors to manually review each session while improving detection accuracy through algorithmic pattern recognition.
Solution Approach 2:
The system implements self-service monitoring where the security system automatically detects, analyzes, and responds to suspicious activities without human intervention. The ML models continuously learn from historical data and autonomously identify unfamiliar or malicious activities, reducing dependency on human resources while maintaining high reliability.
2Reliability
If comprehensive monitoring of all user activities is implemented, then security coverage is improved, but system complexity increases
Solution Approach 1:
The patent segments the monitoring system into specialized ML models that handle different aspects of security analysis separately. Each model focuses on specific types of threats or analysis tasks, processing particular data streams independently before integrating results. This modular approach improves security coverage while managing system complexity through divided responsibilities.
Solution Approach 2:
The system implements universal ML models that perform multiple security functions simultaneously. The same infrastructure and models analyze various data types (user activities, screen recordings, metadata) and detect different threat types (malicious activities, unfamiliar patterns, policy violations), reducing overall system complexity through multi-functional components.
3Speed
If real-time analysis of user activity data is implemented, then response time is improved, but computational resource consumption increases
Solution Approach 1:
The patent applies partial analysis by focusing ML model attention on specific high-risk indicators and unusual patterns rather than analyzing every data point equally. The system performs selective deep analysis only on suspicious segments identified by preliminary filtering, achieving fast response times while reducing overall computational resource consumption through targeted processing.
Data Source
AI summary
Approaches for monitoring a remote access session are described. According to one example, user activity data may be received and processed to ascertain occurrence of an unfamiliar activity event during the remote access session. The user activity data may be indicative of actions executed by a particular user at a user device during the remote access session that is established for remotely accessing an operational technology (OT) network at an organizational site for performing a particular activity. The user activity data may be processed by implementing an activity monitoring model. The unfamiliar activity event may have no association to the particular activity. Upon ascertaining occurrence of the unfamiliar activity event, one or more preventive actions may be initiated. For example, an alert notification may be generated for transmission to a supervisor. Further, immediate termination of the remote access session may be initiated.